CVE-2026-67607 in LightFTP
Summary
by MITRE • 07/31/2026
LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock to cause pthread_join() to operate on an invalid thread ID, resulting in a server crash. CVE-2024-11144 identifies an incomplete fix of this vulnerability.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The LightFTP 2.3.1 server suffers from a critical race condition vulnerability that stems from improper thread management during connection cleanup operations. This flaw exists within the FTP protocol implementation where concurrent access to shared resources creates opportunities for malicious exploitation through timing-based attacks. The vulnerability specifically manifests when a new connection attempts to reuse an FTP context while an ABRT cleanup operation is already in progress, creating a temporal window for system instability.
The technical root cause lies in the unprotected re-check of WorkerThreadId between the worker_thread_cleanup() function and pthread_join() system call execution. This race condition occurs outside of proper MTLock protection mechanisms that should normally synchronize access to thread identifiers during cleanup operations. When multiple threads attempt to access the same context simultaneously, the system fails to properly validate thread state before attempting to join threads, leading to invalid thread ID references.
The operational impact of this vulnerability extends beyond simple server crashes to potentially enable more sophisticated attack vectors. Remote attackers can reliably crash the FTP server by carefully orchestrating connection timing and cleanup operations, resulting in denial of service conditions that compromise availability for legitimate users. The incomplete fix referenced in CVE-2024-11144 suggests that previous mitigation attempts failed to address all aspects of the race condition, leaving the system vulnerable to continued exploitation.
This vulnerability aligns with CWE-362, which describes concurrent execution using shared resource vulnerabilities, and represents a classic example of improper synchronization in multi-threaded environments. The attack pattern follows ATT&CK technique T1499.004 for network denial of service, where adversaries exploit software weaknesses to disrupt services. The flaw demonstrates inadequate thread lifecycle management that allows invalid thread references to propagate through the system. Organizations relying on LightFTP 2.3.1 must implement immediate mitigations including proper MTLock protection around all thread cleanup operations, implementation of robust connection context validation, and consideration of alternative FTP server implementations that properly address multi-threading race conditions.
The vulnerability highlights the importance of comprehensive testing for race conditions in network services and demonstrates how seemingly minor synchronization issues can lead to complete system compromise. Effective mitigation requires not only code-level fixes but also architectural considerations for thread management in concurrent network applications. Security teams should monitor for signs of exploitation attempts and implement proper logging of thread cleanup operations to detect potential abuse of this vulnerability.